From Weak Cues to Real Identities: Evaluating Inference-Driven De-Anonymization in LLM Agents
This highlights a growing privacy threat for users of anonymized data, as identity inference emerges as a first-class risk, even in benign scenarios, and is not incremental but establishes a new evaluation necessity.
The paper tackles the privacy risk of LLM-based agents autonomously reconstructing real-world identities from scattered, non-identifying cues, achieving 79.2% identity reconstruction in the Netflix Prize setting, significantly outperforming a 56.0% classical baseline.
Anonymization is widely treated as a practical safeguard because re-identifying anonymous records was historically costly, requiring domain expertise, tailored algorithms, and manual corroboration. We study a growing privacy risk that may weaken this barrier: LLM-based agents can autonomously reconstruct real-world identities from scattered, individually non-identifying cues. By combining these sparse cues with public information, agents resolve identities without bespoke engineering. We formalize this threat as \emph{inference-driven linkage} and systematically evaluate it across three settings: classical linkage scenarios (Netflix and AOL), \emph{InferLink} (a controlled benchmark varying task intent, shared cues, and attacker knowledge), and modern text-rich artifacts. Without task-specific heuristics, agents successfully execute both fixed-pool matching and open-ended identity resolution. In the Netflix Prize setting, an agent reconstructs 79.2\% of identities, significantly outperforming a 56.0\% classical baseline. Furthermore, linkage emerges not only under explicit adversarial prompts but also as a byproduct of benign cross-source analysis in \emph{InferLink} and unstructured research narratives. These findings establish that identity inference -- not merely explicit information disclosure -- must be treated as a first-class privacy risk; evaluations must measure what identities an agent can infer.